{"id":"CVE-2026-113768","kind":"vulnerability","aliases":["CVE-2026-113768"],"related":[],"title":"Windows Performance Counters: heap overflow lets remote attacker run code","description":"Heap-based buffer overflow in Windows Performance Counters allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in the Windows Performance Counters service lets an unauthorized attacker run code over the network. The sources give no further detail on the trigger or the affected Windows builds.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:56+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","triaged_at":"2026-11-10T19:45:05+00:00","updated_at":"2026-11-10T19:45:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:45:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Performance Counters: heap overflow lets remote attacker run code","impact":"high","summary":"A heap-based buffer overflow in the Windows Performance Counters service lets an unauthorized attacker run code over the network. The sources give no further detail on the trigger or the affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows machine over the network","analyst_note":"Find the Microsoft advisory for CVE-2026-113768 to confirm affected Windows builds, the fixed update and whether the Performance Counters service is reachable by default.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000629,"input_tokens":4494,"output_tokens":359,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft advisory for CVE-2026-113768 to confirm affected Windows builds, the fixed update and whether the Performance Counters service is reachable by default.","search":"'-113768':13A,16A '-2026':12A,15A 'affect':51B 'allow':63C 'attack':8A,34B,66C 'base':22B,56C 'buffer':23B,57C 'build':53B 'code':10A,36B,69C 'counter':3A,29B,62C 'cve':11A,14A 'detail':45B 'execut':68C 'give':42B 'heap':4A,21B,55C 'heap-bas':20B,54C 'infrastructur':17B 'let':6A,31B 'network':39B,72C 'overflow':5A,24B,58C 'perform':2A,28B,61C 'remot':7A 'run':9A,35B 'servic':30B 'sourc':41B 'trigger':48B 'unauthor':33B,65C 'window':1A,18B,27B,52B,60C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-113768':13A,16A '-2026':12A,15A 'attack':8A 'code':10A 'counter':3A 'cve':11A,14A 'heap':4A 'let':6A 'overflow':5A 'perform':2A 'remot':7A 'run':9A 'window':1A","search_b":"'affect':51B 'attack':34B 'base':22B 'buffer':23B 'build':53B 'code':36B 'counter':29B 'detail':45B 'give':42B 'heap':21B 'heap-bas':20B 'infrastructur':17B 'let':31B 'network':39B 'overflow':24B 'perform':28B 'run':35B 'servic':30B 'sourc':41B 'trigger':48B 'unauthor':33B 'window':18B,27B,52B","search_c":"'allow':63C 'attack':66C 'base':56C 'buffer':57C 'code':69C 'counter':62C 'execut':68C 'heap':55C 'heap-bas':54C 'network':72C 'overflow':58C 'perform':61C 'unauthor':65C 'window':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113768","severity":null,"published_at":"2026-11-10T19:18:56+00:00","modified_at":"2026-11-10T19:18:56+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","fetched_at":"2026-11-10T19:24:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}